
var target_ptr = []

function main() {
        Java.perform(function (){
        

            if(false)
            Java.use("android.app.Activity").onCreate .overload('android.os.Bundle').implementation = function (bundle){

                console.log(this.getClass().getName());
                var activityName = this.getClass().getName()
                if ( activityName .indexOf('aligames.shootAndroid')>0 
                    || activityName .indexOf('gundam.sdk')>0){
                    this.onCreate(bundle)
                }else{

                    this.onCreate(bundle)
                    this.finish()

                }

            
        }

        var moduleName = "libil2cpp.so";
        var setTimeScale = null
        var getTimeScale = null
        
        Interceptor.attach(Module.findExportByName(null, "dlopen"), {
            onEnter: function(args) {
                this.lib = Memory.readUtf8String(args[0]);
                console.log("dlopen called with: " + this.lib);
            },
            onLeave: function(retval) {

                // if (this.lib.endsWith('libunity.so') && false) {
                //     var baseAddr = Module.findBaseAddress('libunity.so');
                //     //0xF2D6C jiasu
                //     setTimeScale = new NativeFunction(baseAddr.add(0xF2D6C), "pointer", ["float"])
                //     console.log('setTimeScale')
                //     console.log(setTimeScale)

                //   //  getTimeScale = new NativeFunction(baseAddr.add(0xF2D58), "pointer", ["float"])
                //     console.log('getTimeScale')
                //  //   console.log(getTimeScale)

                    
                //     if(true)
                //     Interceptor.attach(baseAddr.add(0xF2D58), {
                //         onEnter: function (args) {
                //         }, 
                        
                //         onLeave: function (retval) {
                //            // retval.replace(jstring)
                //            if(this.context.s0 > 1)
                //            {
                //             this.context.s0 = 1
                //            }
                //             // console.log('called from:\n' +
                //             // Thread.backtrace(this.context, Backtracer.ACCURATE)
                //             // .map(DebugSymbol.fromAddress).join('\n') + '\n')
                //             return retval
                //         }
                //     })
                //      // console.log(JSON.stringify({
                //     //         //     a1: args[1].toInt32(),
                //     //         //     a2: Memory.readUtf8String(Memory.readPointer(args[2])),
                //     //         //     a3: Boolean(args[3])
                //     //         // }, null, '\t'));
                //     //     }
                //     // });
         

                // }

                if (this.lib.endsWith(moduleName)) {


                    console.log("ret: " + retval);
                    var baseAddr = Module.findBaseAddress(moduleName)
                    console.log("baseAddr: " + baseAddr)
                  

               
                    
                //   Interceptor.attach(baseAddr.add(0x11F0594), {
                //     onEnter: function(args) {

                //         console.log(( ptr(this.context.x8)))
                  
                //     }, onLeave: function (retval) {
                
                //     } 口袋进化 0x727404  口袋日月 0xC6EDB4 口袋逆袭 0x13C017C  0x1a00e58 掌机小精灵 0x1049308 猫咪大陆
                // })

                //河图寻仙记 0x1B953A0 千秋辞 0xE29B14 幻之封神 0x1594D50 末日血战 //    ElfAddr text_hook_offset = 0x15CA32C; onDisable_offset = 0x15CAF5C;
                //口袋新世界（未知）
                //zhyhc2 0x1DB4494 0x1DB4CD4
    
          {
            
            var text_hook_offset = 0x120B574;
            var onDisable_offset = 0x120C134;

       

(function () {

    // @ts-ignore
    function print_arg(addr) {
        try {
            var module = Process.findRangeByAddress(addr);
            if (module != null) return "\n"+(addr) + "\n";
            return ptr(addr) + "\n";
        } catch (e) {
            return addr + "\n";
        }
    }

    // @ts-ignore
    function hook_native_addr(funcPtr, paramsNum) {
        var module = Process.findModuleByAddress(funcPtr);
        try {
            Interceptor.attach(funcPtr, {
                onEnter: function (args) {
                    this.logs = "";
                    this.params = [];
                    // @ts-ignore
                    // this.logs=this.logs.concat("So: " + module.name + "  Method: UnityEngine.UI.Text$$set_text offset: " + ptr(funcPtr).sub(module.base) + "\n");
                    // for (let i = 0; i < paramsNum; i++) {
                    //     this.params.push(args[i]);
                    //     this.logs=this.logs.concat("this.args" + i + " onEnter: " + print_arg(args[i]));
                    // }
               
                  //  console.log('readUtf16String--->'+data)
                    // var txt = Memory.readUtf16String(ptr(args[1]).add(20),Memory.readInt(ptr(args[1]).add(0x10)))
                    console.log(hexdump(args[1]))
                   

                    // var len = 2*Memory.readInt(ptr(args[1]).add(0x10))
                    // var arrayBuffer = Memory.readByteArray((ptr(args[1]).add(0x8).add(0x4)) , len)
                    // var uint8Array = new Uint8Array(arrayBuffer);
                    // //console.log(uint8Array)
            
                    // //if(uint8Array.length<50)   
                    // for (let index = 0; index < uint8Array.length; index++) {
                    //   //   开始游戏 
                    //   //   00 5F CB 59 38 6E 0F 62
                    // //     隐私政策
                    // //     90 96 C1 79 3F 65 56 7B
                    // //     隐私协议
                    // //     90 96 C1 79 4F 53 AE 8B
                    // // if(len==8 && uint8Array[index]==0x00 &&uint8Array[index+1]==0x5F && uint8Array[index+2]==0xcb && uint8Array[index+3]==0x59 &&uint8Array[index+4]==0x38&&uint8Array[index+5]==0x6e  )
                    //     if(len<100 && uint8Array[index]==0x90 && uint8Array[index+1]==0x96 && uint8Array[index+2]==0xc1 &&uint8Array[index+3]==0x79  )
                    //     {
                            
                    //        target_ptr.push(args[0])
                    //        console.log('found target ptr',target_ptr)
                           

                    //     }
                        
                    // }
                }, onLeave: function (retval) {
                    // for (let i = 0; i < paramsNum; i++) {
                    //     this.logs=this.logs.concat("this.args" + i + " onLeave: " + print_arg(this.params[i]));
                    // }
                    // this.logs=this.logs.concat("retval onLeave: " + print_arg(retval) + "\n");
                    // console.log(this.logs);
                }
            });
        } catch (e) {
            console.log(e);
        }
    }
    // @ts-ignore
    hook_native_addr(Module.findBaseAddress("libil2cpp.so").add(text_hook_offset), 0x3);
})();




            


(function () {

    // @ts-ignore
    function print_arg(addr) {
        try {
            var module = Process.findRangeByAddress(addr);
            if (module != null) return "\n"+(addr) + "\n";
            return ptr(addr) + "\n";
        } catch (e) {
            return addr + "\n";
        }
    }

    // @ts-ignore
    function hook_native_addr(funcPtr, paramsNum) {
        var module = Process.findModuleByAddress(funcPtr);
        try {
            Interceptor.attach(funcPtr, {
                onEnter: function (args) {
                 //   console.log('UnityEngine.UI.Text$$OnDisable',args[0])

                //    console.log((args[0]))
                    for (let index = 0; index < target_ptr.length; index++) {
                        if(target_ptr[index]!=null && target_ptr[index].toString()===args[0].toString()){
                            console.log('check user argre done')
                        }
                    }
                   
                }, onLeave: function (retval) {
                    
                }
            });
        } catch (e) {
            console.log(e);
        }
    }
    // @ts-ignore
    hook_native_addr(Module.findBaseAddress("libil2cpp.so").add(onDisable_offset), 0x2);
})();

            



(function () {

    // @ts-ignore
    function print_arg(addr) {
        try {
            var module = Process.findRangeByAddress(addr);
            if (module != null) return "\n"+hexdump(addr) + "\n";
            return ptr(addr) + "\n";
        } catch (e) {
            return addr + "\n";
        }
    }

    // @ts-ignore
    function hook_native_addr(funcPtr, paramsNum) {
        var module = Process.findModuleByAddress(funcPtr);
        try {
            Interceptor.attach(funcPtr, {
                onEnter: function (args) {
                 
                }, onLeave: function (retval) {
                    
                }
            });
        } catch (e) {
            console.log(e);
        }
    }
    // @ts-ignore
    hook_native_addr(Module.findBaseAddress("libil2cpp.so").add(0x18eb118), 0x3);
})();




          }

                    if(false)
                    {



                  //  0x6472A0 CodeStage.AntiCheat.Detectors.SpeedHackDetector$$StopDetection
                  // 0x647398  CodeStage.AntiCheat.Detectors.SpeedHackDetector$$Dispose
                  var SpeedHackDetectorStopDetection = new NativeFunction(baseAddr.add(0x6472A0) , "void", ["pointer"])
                  var SpeedHackDetectorDispose = new NativeFunction(baseAddr.add(0x647398) , "void", ["pointer"])

  
                    // var addr = baseAddr.add(0x730AB0)
                    // Memory.patchCode(addr, Process.pageSize , function (code) {
                    //     var codeWriter = new Arm64Writer(code, { pc: addr });
                     
                    //     codeWriter.putInstruction(0x00009052);
                    //     codeWriter.flush();

                    // });
                    var method = null
                  //  0x646D04
                  Interceptor.attach(baseAddr.add(0x646D04), {
                    onEnter: function(args) {

                        method = ptr(args[0])

                    }
                })

                   // 0x859694
                    Interceptor.attach(baseAddr.add(0x859694), {
                        onEnter: function(args) {

                           this.context.s0 = 11111

                        }
                    })
   
                    if(false)
                    {

                    var count = 0
                    var baseStatueAddr1 = null
                    var baseStatueAddr2 = null
                    Interceptor.attach(baseAddr.add(0x808950), {
                        onEnter: function(args) {

                            console.log(((ptr(args[0]))))
                            if(count % 2 == 0){
                                baseStatueAddr1 = ptr(args[0])
                            }else{
                                baseStatueAddr2 = ptr(args[0])
                            }
                            count ++ 

                        }
                    })

                          //0x7C8E50   无限指挥点
                    var addr = baseAddr.add(0x7C8E50)
                    Memory.patchCode(addr, Process.pageSize , function (code) {
                        var codeWriter = new Arm64Writer(code, { pc: addr });
                        //data.writeS64();
                        codeWriter.putInstruction(0x1f2003d5);
                        //cw.putBrReg()
                        //cw.putRet();
                        codeWriter.flush();
                    });

                    var addr = baseAddr.add(0x7B674C)
                    Memory.patchCode(addr, Process.pageSize , function (code) {
                        var codeWriter = new Arm64Writer(code, { pc: addr });
         
                        codeWriter.putInstruction(0x1f2003d5);
                        codeWriter.flush();
                    });

                    

                    var addr = baseAddr.add(0x64757C)
                    Memory.patchCode(addr, Process.pageSize , function (code) {
                        var codeWriter = new Arm64Writer(code, { pc: addr });
         
                        codeWriter.putInstruction(0x1f2003d5);
                        codeWriter.flush();
                    });

                    //85CEA4
                    var addr = baseAddr.add(0x85CEA4)
                    Memory.patchCode(addr, Process.pageSize , function (code) {
                        console.log('----->'+addr)
                        var codeWriter = new Arm64Writer(code, { pc: addr })
                        codeWriter.putInstruction(0x2020211E);
                       // codeWriter.putInstruction(0x1E212020);
                        codeWriter.flush();
                        console.log((addr))
                    })

                    
                    // var addr = baseAddr.add(0x625EC8)
                    // Memory.patchCode(addr, Process.pageSize , function (code) {
                    //     var codeWriter = new Arm64Writer(code, { pc: addr })
                    //     codeWriter.putInstruction(0x00102E1E)
                    //     codeWriter.flush();
                    //     console.log('----->'+addr)
                    //     console.log((addr))
                    // })

                  
                
                   
                    Interceptor.attach(baseAddr.add(0x80D35C), {
                        onEnter: function(args) {

                            Memory.writeFloat(baseStatueAddr1.add(0xd0),1000000)//锁血
                            //Memory.writeFloat(baseStatueAddr2.add(0xd0),100)//秒杀

                            //无限人口
                            //[[libil2cpp.so.1+1AED730]+b8]+4


                            var populationLimitAddr = Memory.readPointer(Memory.readPointer(ptr(baseAddr).add(0x1AED730)).add(0xb8)).add(4)
                            //console.log(Memory.readInt(populationLimitAddr))
                            Memory.writeInt(populationLimitAddr,999)
                          
                             //写入金币
                            console.log(ptr(args[1]).add(0x60))
                            console.log(Memory.readInt(ptr(args[1]).add(0x60)))
                            Memory.writeInt(ptr(args[1]).add(0x60),999999)
                        }
                    })

             
                    {
                        setInterval(function(){
                           
                            setTimeScale(5.0)
                        }, 10000)
                        
                    }
          
                    }
                    }
       




            


                }
            }
        });

        var fileName
        var dlopen_ext = Module.findExportByName(null, 'android_dlopen_ext')
        Interceptor.attach(dlopen_ext, {
            onEnter: function (args) {

                fileName = ptr(args[0]).readCString()
                console.log(fileName)

            }, onLeave: function (ret) {
                if (fileName.endsWith(moduleName)) {

                    var baseAddr = Module.findBaseAddress(moduleName);
                    console.log("baseAddr")
                    console.log(baseAddr)

                }
                return ret
            }
        })


    })


}
setImmediate( main );


// conda activate py38env
// frida -U com.zjqd.mzxq.aligames -l u3dil2c
// frida -U com.cyou.xjikp5.aligames -l hookjnionload.js
// frida -U --no-pause -f com.cyou.xjikp5.aligames -l hookjnionload.js
// frida -U --no-pause -f com.youzu.ss0.aligames -l hookjnionload.js
// frida -U --no-pause -f com.yrtgame.stickvar.aligames -l hookjnionload.js
// frida -U -f com.yrtgame.stickvar.aligames -l hookjnionload.js
// frida -U -f war.of.islands -l hookjnionload.js
// frida -U -f com.game4fun.lmyss.aligames -l hookjnionload.js
// frida -U -f com.tanyu.cjhwy.aligames -l hookjnionload.js

// frida -U -f com.chumeng.zeus.tt -l hookjnionload.js
// frida -U -f com.mmdl.shmmj.aligames -l hookjnionload.js
// frida -U -f com.quanmai.pmp.aligames -l hookjnionload.js >log.log
// frida -U -f com.hyCompany.Pokemon.uc -l hookjnionload.js
// frida -U -f com.saturngame.pm2.x7sy -l hookjnionload.js
// frida -U -f com.xinmi.kdnx.aligames -l hookjnionload.js
// frida -U -f com.droidhang.ad2.aligames -l hookjnionload.js >log.log
// frida -U -f com.soulpainter.qise.aligames -l hookjnionload.js >log.log
// frida -U -f com.haimi.hzfs.nearme.gamecenter -l hookjnionload.js >log.log
// frida -U -f com.mmdl.shmmj.aligames -l hookjnionload.js >log.log
// frida -U -f com.quanmai.pmp.aligames -l hookjnionload.js >log.log
// frida -U -f com.ldmrxz.aligames -l hookjnionload.js >log.log
// frida -U -f com.izhaohe.zhaohe2.aligames -l hookjnionload.js >log.log
// frida -U -f com.izhaohe.zhaohe2 -l hookjnionload.js >log.log
// frida -U -f com.ldmrxz.aligames -l hookjnionload.js >log.log
// frida -U -f com.bzsh.bingniao.nearme.gamecenter -l hookjnionload.js >log.log












